Limit permissions for CI jobs where possible

.github/workflows/android.yml

@@ -9,6 +9,20 @@ on:
   pull_request:
     branches:
       - main
+permissions:
+  actions: none
+  checks: none
+  contents: read
+  deployments: none
+  discussions: none
+  id-token: none
+  issues: none
+  packages: none
+  pages: none
+  pull-requests: none
+  repository-projects: none
+  security-events: none
+  statuses: none
 env:
   JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64
 jobs:

.github/workflows/changelog-to-fastlane.yml

@@ -6,6 +6,20 @@ on:
       - main
     paths:
       - 'CHANGELOG.md'
+permissions:
+  actions: none
+  checks: none
+  contents: read
+  deployments: none
+  discussions: none
+  id-token: none
+  issues: none
+  packages: none
+  pages: none
+  pull-requests: write
+  repository-projects: none
+  security-events: none
+  statuses: none
 jobs:
   convert_changelog_to_fastlane:
     runs-on: ubuntu-latest

.github/workflows/contributors-to-file.yml

@@ -3,7 +3,20 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '3 4 * * 0'
-
+permissions:
+  actions: none
+  checks: none
+  contents: write
+  deployments: none
+  discussions: none
+  id-token: none
+  issues: none
+  packages: none
+  pages: none
+  pull-requests: write
+  repository-projects: none
+  security-events: none
+  statuses: none
 jobs:
   contributors_to_file:
     runs-on: ubuntu-latest

.github/workflows/generate-feature-graphic.yml

@@ -6,6 +6,20 @@ on:
       - main
     paths:
       - 'fastlane/**/title.txt'
+permissions:
+  actions: none
+  checks: none
+  contents: write
+  deployments: none
+  discussions: none
+  id-token: none
+  issues: none
+  packages: none
+  pages: none
+  pull-requests: write
+  repository-projects: none
+  security-events: none
+  statuses: none
 jobs:
   generate-feature-graphic:
     runs-on: ubuntu-latest

.github/workflows/update-locales.yml

@@ -6,6 +6,20 @@ on:
       - main
     paths:
       - app/src/main/res/values/settings.xml
+permissions:
+  actions: none
+  checks: none
+  contents: write
+  deployments: none
+  discussions: none
+  id-token: none
+  issues: none
+  packages: none
+  pages: none
+  pull-requests: write
+  repository-projects: none
+  security-events: none
+  statuses: none
 jobs:
   update-locales:
     runs-on: ubuntu-latest